This is a table I created using the timechart command. Now, I am trying to make a line graph with this information with date on the x-axis and completion time for the y-axis. If I am able to solve that, I would love to add extra lines to the line graph.
<searchString>host=... source = ... Position="Finished" AND Report | timechart latest(TIME) as Completion_Time</searchString> <earliestTime>-168h</earliestTime> <latestTime>$timetoken.latest$</latestTime>
This is inside my dashboard atm. I have a drop down for time at the top.
The CompletionTime field is string value and as far as I know, strings can't be plotted in Y-axis (you need numerical values). Workaround, you can convert your CompletionTime to decimal number like
HH.MM and plot them.
In replace, I'm clubbing your data in 3 parts (values inside the brackets), and replacing 3 parts named 1,2,3 from current format of
1:2:3 to 1.2
Would you know how to add a second line?
host=.. source =.. SOMESTRINGTOLOOKFOR | timechart latest(TIME) as Completion_Time | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))